Allowing researchers to use existing hospital data without patient permission illustrates which HIPAA privacy principle?

• A. Boundaries
• B. Public Responsibility
• C. Security
• D. Consumer Control

Answer: (B)

This tests how HIPAA allows data to be used for research in the public interest under proper oversight. Public Responsibility recognizes that sharing information for research and public health can benefit society, but this must be balanced with privacy protections. When researchers access existing hospital data without patient permission, it typically happens under a waiver of authorization approved by an IRB or Privacy Board, or by using de-identified data, with safeguards in place. This combination of oversight and safeguards embodies the public-interest duty to enable beneficial uses of data while protecting individuals’ privacy.

Boundaries focus on patient privacy preferences and expectations. Security is about protecting data from unauthorized access. Consumer Control centers on individuals’ rights to access or control their own PHI. None of those capture the specific allowance for research use without consent in the same way as Public Responsibility.